# Which benefits do Twists of elliptic curves bring?

I understand that an elliptic curve $$E$$ over a field $$K$$ has an associated twist, that is another elliptic curve which is isomorphic to $$E$$ over an algebraic closure of $$K$$.

Which cryptographic benefits do twists of elliptic curves bring?

• Oct 20, 2023 at 19:04
• Well, although they are isomorphic in the closure, the closure is not a good field for the performance, so we work on the base field. In this case, the twist needs to have large subgroups to be secure against the twist attack Oct 20, 2023 at 19:05
• This may be hard for people to understand if they do not understand the maths behind elliptic curves. Can we conclude that publishing a twisted version of a curve that this is because it indicates what kind of attacks can be performed against schemes that use the particular curve? Most answers do describe the math well, but they fall short of giving a comprehensive answer on how twisted curves are used, if at all. Oct 20, 2023 at 21:28

We want fast and secure arithmetic and sometimes the twist of a curve may produce secure and faster arithmetic;

• EdDSA : Ed25519 : twisted Edwards curve :

High-speed high-security signatures - 2011 Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang

• Fast
• fast single-signature verification
• Even faster batch verification.
• Very fast signing
• Fast key generation
• Secure
• No secret branch conditions
• No secret array indices
• Uses a twisted Edwards curve that is birationally equivalent to the curve Curve25519 implied ECDLP is equivalent to Curve25519

The Edwards-curve Digital Signature Algorithm (EdDSA) is a variant of Schnorr's signature system with (possibly twisted) Edwards curves.

So, whenever there is a benefit, the twist can be used.

A note on the birationally equivalence

Birationally equivalence is the relaxation of the isomorphism where we want some of the points not mapped with the forward and backward birational maps.

Now, we know that Discrete Logarithms are random self-reducibility. What this tells us; if we can solve Dlog in one base then we can solve any base. (Solve for base $$G$$ the find $$P = [a]G$$ for base $$P$$ and see $$S = [t]P = [ta]G$$..)

By using this and birationally equivalence we can argue that if Dlog hard in Curve25519 then DLog is hard in the twisted Edwards curve. too. If easy then it is easy there too. Just map the points and solve them. If the points are not mappable then use some other as a base use random self-reducibility.

• Could be enhanced by indicating if using the twisted curve would create fully compatible results. Oct 20, 2023 at 23:02
• @MaartenBodewes do you mean the points are not mapped due to birationally equivalence? they are finite, however, the main point of birational equivalence is Our recommended curve for EdDSA is a twisted Edwards curve birationally equivalent to the curve Curve25519 from [12]. Any efficiently computable birational equivalence preserves ECDLP difficulty, so the well-known difficulty of computing ECDLP for Curve25519 immediately implies the difficulty of computing ECDLP for our curve. Not really mapping the points... Otherwise we need to consider the to exclude the non-mapping points! Oct 20, 2023 at 23:27
• @kelalaka how do twists bring faster arithmetic in comparison with protocols that don't use them (asking because unified addition is also available for Edward curves that are not twisted)? Oct 21, 2023 at 7:23
• There is no magic but deep study there. When you get the quadratic twist, you need to see what you get get this from this twist. This requires looking from the coordinate systems to protocols that can benefit from this. For study, you can generate a random Edward's curve ( possibly large ) and see what this twist can be useful or not. Oct 21, 2023 at 9:32